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288A-L-A-6981048 Serial 1 


UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U) To Request Opening of Captioned 
Investigation . 


Date: 02/05/2016 


From: LOS ANGELES 

LA-CY-2 ( SSA 


Contact: 



Approved By: SSAl 


Drafted By: 


Case ID #: 288A-LA-698104 8 


(U) UNSUB (S); 

BREITBART NEWS NETWORK - VICTIM; 


Synopsis: (U) To Request Opening of Captioned Investigation. 


Enclosure (s) : Enclosed are the following items: 
1. (U) Complaint Email from 

Details : 


busines s email address | 

address | cell phone number 

Los Angeles with the following complaint. 


alternate email 


contacted FBI 


On 19 Jan 2016, FBI Los Angeles received an email f rom | | stating 

Breitbart News Network, had been 

experiencing a persistent Distributed Denial of Service (DDoS) attack 
for the previous two days. stated he wished to share the source 

addresses with the FBI to see if the attacker was a known actor, and 
explore the possibility that the identity of the criminal could be 
identified from this information. 


stated the sustained DDoS traffic was 
also stated I 


UNCLASSIFIED 











288A-LA-69S1048 Serial 1 

UNCLASSIFIED 

Title: (U) To Request Opening of Captioned Investigation. 

Re: 288A-LA-6981048, 02/05/2016 



It is requested that a case be opened and assigned to the writer. 


♦ ♦ 


UNCLASSIFIED 


2 




O riginal Message 

From: 

Sent: Tuesday, January 19, 2016 12:50 PM 

To: | l (LA) (FBI} 

Subject: Request for assistance 


b6 

b7C 

b7E 


t Breitbart News Network) who has been under constant DDoS attack for the past two days 
d like to share the source addresses with you to see if this is a known actor, and explore the 
possibility that the identity of the criminal can be identified from this fingerprint. Is this something we can possibly 
collaborate on? 


Please advise. 


Thanks, 


288A-L A-698 1 048_000000 1_ 1 AOOOOOO 1 000000 1.txl[7/1 3/20 17 6:37:18 AM| 
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288A-LA-6931048 Serial 2 

UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 

Electronic Communication 


Title: (U) List of DDoS IP Addresses from Date: 04/29/2016 


From: LOS ANGELES 

LA-CY-2 ( SSA 

Contact: I 


Approved By : SSA 


Drafted By: 


Case ID #: 288A-LA-6981048 (U) UNSUB (S); 

BREITBART NEWS NETWORK - VICTIM; 


b6 

b7C 


Synopsis: (U 

traffic targeting Breitbart News Network. 


Jprovided logs documenting DDoS 


b7E 


Enclosure (s) : Enclosed are the following items: 

1. (U) Email content ATT00003 

2. (U) Email content ATT00004 

3. (U) Email of Evidence from DDoS Attack 

4. (U) List of IP Addresses 


Details : 


On 20 Jan 2016, 



business email address | 


alternate email address 1 

cell phone number 


provided the following information to the writer by email 


concerning a Distributed Denial of Service (DDoS) attack against 
Breitbart News Network. 


| ~| a list of IP addresses which were 

actively sending malicious traffic to the Breitbart News Network 


servers . 


estimated approximately 





b6 

b7C 

b7E 


UNCLASSIFIED 







288 A-LA- 698104 S Serial 


UNCLASSIFIED 

Title: (U) List of DDoS IP Addresses 

Re: 288A-LA-6981048, 04/29/2016 



A copy of the email from [ [ and the list of IP addresses are 

included with this document as a 1A Package. 


UNCLASSIFIED 


2 






b7E 





b6 

b7C 

b7E 


288A -LA-698 1 ()48_0()00()02_ I A0(!()0()02_0fl00002.1xl|7/ 1 3/20 1 7 6:37:55 A\l] 




Original Message- 

From:! - 


Se nt: Wednesday, Janu ary 20, 2016 10:50 AM 


To: 


(LA) (FBI) 


Subject: Evidence from DDoS Attack 


Here is the current list of IP Addresses 


b6 

b7C 

b7E 


288A-L A-698 1 ()48_0()00()02_ I A0fl()0()02_0000003 . txtf 7/ 1 3/20 1 7 6:37:55 AMI 
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288A-LA-6931048 Serial 3 

UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 

Electronic Communication 


Title: (U) Updated List of IP Addresses 


Date: 04/29/2016 


From: LOS ANGELES 

LA-CY-2 ( SSA j~ 
Contact: 1 


Approved By : SSA 


b6 

b7C 


Drafted By: 


Case ID #: 288A-LA-6981048 (U) UNSUB (S); 

BREITBART NEWS NETWORK - VICTIM; 


Synopsis: 

addresses 


(U 


provided an updated list of 


targeting the Breitbart News Network 


IP 


b7E 


Enclosure (s) : Enclosed are the following items: 

1. (U) Re Evidence fro DDoS Attack 

2. (U) Email content ATT00002 

3. (U) List of IP addresses 


Details : 


On 21 Jan 2016, 


busines s email address | 


alternate email address 


cell phone number 


provided the following information to the writer by email 
concerning a Distributed Denial of Service (DDoS) attack against 
Breitbart News Network. 


| included an updated list of IP addresses which 
were actively sending malicious traffic to the Breitbart News Network 
servers . 


The updated list included 


IP addresses. 


b6 

b7C 

b7E 


UNCLASSIFIED 








288A-LA-69S1048 Serial 3 

UNCLASSIFIED 

Title: (U) Updated List of IP Addresses 

Re: 288A-LA-6981048, 04/29/2016 


A copy of the email and updated IP address list is included with 
this document as a 1A Package. 


♦ ♦ 


UNCLASSIFIED 


2 




288A-L A-698 1 048_0000003_ I A00()0()03_000000 1.txl|7/1 3/20 1 7 6:38:3 1 AMI 





On Jan 21, 2016, at 9:25 AM, 


(LA) (FBI)[ 


wrote: 


DC 1 5 starting to look at it right now. if you have the updated list, fee! free to send it my way. 


b6 

b7C 


From: 

Se nt: Thursday, Janua ry 21, 2016 8:59 AM 


To* 


(LA) (FBI) 


Subject: Re: Evidence fro DDoS Attack 


The list of IP addresses has grown to 


Do you want an updated list? Any word back from DC? 


On Jan 20, 2016, at 11:42 AM, 


wrote 


Yes, I sent it over there for you. I can also put it on a web server for download if that would be 
better. 


b6 

b7C 



From: | 

Se nt: Wednesday, Jan uary 20, 2016 10:36 AM 


To: 

Subject: Evidence fro DDoS Attack 


](LA) (FBI) 


b6 

b7C 

b7E 


Thanks f or your call this mor ning. I'm going to switch email addresses and contact 
you from 


288A-LA-698 1 04S_0000003_ I A0(i00()03_0(if)0002. lit m|7/ 13/20 1 7 6:38:49 AMI 











288A-L A-698 1 ()48_0()00()03_ I AO(K)0()03_0000002.hI m|7/13/20 1 7 6:38:49 AMI 



KD- 1057 (Rev. 5-8-10) 


288A-L-A-6981048 Serial 4 


UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U) Revised List of IP Addresses 


Date : 


05/09/2016 


From: LOS ANGELES 

LA-CY-2 ( SSA 
Contact: 


Approved By: SSA 


Drafted By: 


b6 

b7C 


Case ID #: 288A-LA-6981048 


(U) UNSUB (S); 

BREITBART NEWS NETWORK - VICTIM; 


Synopsis: (U; 


revised an earlier list of IP addresses due 


to a malfunctioning ad network sending erroneous traffic. 


Enclosure (s) : Enclosed are the following items: 

1. (U) Email from I I 

2. (U) Email from! 


( ATT00002 ) 


3. (U) Revised list of IP Addresses 


b7E 


Details : 


On 21 Jan 20 16, [ 


business email address 


alternate email address 


J cell phone number 


provided the following information to the writer by email 
concerning a Distributed Denial of Service (DDoS) attack against 
Breitbart News Network. 


In an earlier email the same day, 
approximately 


provided a list of 


JlP addresses he believed to be a part of an 


ongoing DDoS attack against the Breitbart News Network. After further 
investigation, | | determined a large portion of that traffic was due 
to a malfunctioning ad network. 


b6 

b7C 

b7E 


UNCLASSIFIED 








288A-LA-69S1048 Serial 4 

UNCLASSIFIED 

Title: (U) Revised List of IP Addresses 

Re: 288A-LA-6981048, 05/09/2016 


re-examined the list of IP addresses he had previously compiled 

and filtered out the ad network traffic. After this filtering process, 



provided a copy of the updated IP address list. 


The list and email from 


Package . 


| | is i 


included with this document in a 1A 


♦ ♦ 


UNCLASSIFIED 


2 
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288A-LA-6981048 Serial 5 

UNCLASSIFIED 




FEDERAL BUREAU OF INVESTIGATION 

Electronic Communication 


Title: (U) IP Address Analysis by 


Date: 05/17/2016 


From: LOS ANGELES 

LA-CY-2 ( SSA 
Contact: 


Approved By : SSA 


Drafted By: 


Case ID #: 288A-LA-6981048 (U) UNSUB (S); 

BREITBART NEWS NETWORK - VICTIM; 


Synopsis: (U) Analysis of IP addresses conducted by 


Enclosure (s) : Enclosed a re the follo wing items: 

1. (U) Updated log file I I 

2. (U) Analysis by f j 


Details : 



On 21 

Jan 2016, 





business email address 


□ 


5 email address 


cell phone number 



o the captioned investigation. 


the writer contacted IA 


e same dav 


vision 


of FBI 


After downloading and analyzing the traffic provided by | | IA 

technical analysis resulted in the following information 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


b6 

b7C 

b7E 


UNCLASSIFIED 










288A-LA-6981048 Serial 5 


UNCLASSIFIED 

Title: (U) IP Address Analysis by 

Re: 288A-LA-6981048, 05/17/2016 






288A-LA-6981048 Serial 5 

UNCLASSIFIED 

Title: (U) IP Address Analysis by 

Re: 288A-LA-6981048, 05/17/2016 



!A[ 


highlighted the 


following facts: 








UNCLASSIFIED 


5 







From: 

Se nt: Thursday. Januar y 21, 2016 12:37 PM 
To | (LA) (FBI) 


Subject: Re: Evidence fro DDoS Attack 


Here is an updated log file as well: 


b6 

b7C 

b7E 



On Jan 21, 201 6, at 9:25 AM 


}LA)(FB[)[ 


wrote: 


DC is starting to look at it right now. If you have the updated list, feel free to send it my way. 


F rom :| 

Se nt: Thursday. Januar y 21, 2016 8:59 AM 
To:| ](LA) (FBI) 


Subject: Re: Evidence fro DDoS Attack 


The list of IP addresses 


]Do you want an updated list? Any word back from DC? 


On Jan 20, 2016, at 11:42 AM, 


wrote: 


b6 

b7C 


b6 

b7C 

b7E 


Yes, I sent it over there for you I can also put it on a web server for download if that would be better. 


On Jan 20, 2016, at 1 1:29 AM 


(LA) (FBI) 


wrote: 


288A-LA-698 1 048_0000005_ 1 A0000005_000000 1.tx!|7/1 3/20 17 6 40 03 AMI 














Thanks for your call this morning. I' m going to switch email addresses and contact you from] 



28SA-L A-698 1 048_0000005_ I A0(!()0()05_0fl0000 1.t\l|7/1 3/20 [7 6 40 03 AM| 







From: 
Sent: ' 
To: 
Sub 


(CYD) (FBI) 

ridav. January' 2 2. 2016 10:54 AM 
(LA) (FBI) 


ect: RE: More Evidence fro DDoS Attack 


b6 

b7C 

b7E 



288A-L A-698 1 ()48_0()00()05_ 1 A0000005_0000002.txl|7/ 1 3/20 1 7 6 40 09 AMI 








Let me know if you think I missed something, this doesn't make sense, or you're looking for something different. 


b6 

b7C 

b7E 


From :) (LA) (FBI) 

Se nt: Thursday. Jan uary 21, 2016 4:43 PM 
To l | (CYD) (FBI) 

Subject: More Evidence fro DDoS Attack 



also put a new sample log file up, you can grab it here: 
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b7C 

b7E 






